目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,226
关联 CVE
1,856
参与项目数
342
近 7 天新增
7
严重度: All CriticalHighMediumLow
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 657 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Cross site scripting
U.S. Dept Of Defense Cross-site Scripting (XSS) - Reflected (CWE-79)
Medium
2021-07-29
Buffer Overflow in smblib.c
Internet Bug Bounty Classic Buffer Overflow (CWE-120)CVE-2019-18353
Medium
2021-07-28
tcpdump before 4.9.3 has a heap-based buffer over-read related to aoe_print in print-aoe.c and lookup_emem in addrtoname.c
Internet Bug Bounty Buffer Over-read (CWE-126)CVE-2017-16808
Medium
2021-07-23
Canonical Snapcraft vulnerable to remote code execution under certain conditions
Internet Bug Bounty CVE-2020-27348
Medium
2021-07-23
Account takeover through multistage CSRF at https://autochoice.fas.gsa.gov/AutoChoice/changeQAOktaAnswer and ../AutoChoice/changePwOktaAnswer
U.S. General Services Administration Cross-Site Request Forgery (CSRF) (CWE-352)
Medium
2021-07-23
[Lark Android] Vulnerability in exported activity WebView
Lark Technologies Cross-site Scripting (XSS) - Generic (CWE-79)
Medium
2021-07-22
pam_ussh does not properly validate the SSH certificate authority
Uber Improper Authentication - Generic (CWE-287)
Medium
2021-07-21
CVE-2021-22926: CURLOPT_SSLCERT mixup with Secure Transport
curl Business Logic Errors (CWE-840)CVE-2021-22926
Medium
2021-07-21
CVE-2021-22923: Metalink download sends credentials
curl Cleartext Transmission of Sensitive Information (CWE-319)CVE-2021-22923
Medium
2021-07-21
CVE-2021-22922: Wrong content via metalink not discarded
curl Business Logic Errors (CWE-840)CVE-2021-22922
Medium
2021-07-21
Multiple server ssh usernames leaked in your github repository
Ian Dunn Information Disclosure (CWE-200)
Medium
2021-07-19
Reflected XSS via "Error" parameter on https://admin.acronis.com/admin/su/
Acronis Cross-site Scripting (XSS) - Reflected (CWE-79)
Medium
2021-07-19
OS Command Injection in '/lib/un.rb -- Utilities to replace common UNIX commands in Makefiles etc'
Ruby OS Command Injection (CWE-78)
Medium
2021-07-19
Leak arbitrary file under nextcloud android client privacy directory
Nextcloud CVE-2021-32695
Medium
2021-07-17
User deletion is not handled properly everywhere
Nextcloud
Medium
2021-07-15
[Bypass fixed #664038 and #519059] Application settings change settings that have been set by the user
X / xAI Business Logic Errors (CWE-840)
Medium
2021-07-13
Stored-XSS on wiki pages
GitLab Cross-site Scripting (XSS) - Stored (CWE-79)
Medium
2021-07-13
OS Command Injection in 'rdoc' documentation generator
Ruby OS Command Injection (CWE-78)CVE-2021-31799
Medium
2021-07-13
your-store.myshopify.com preview link is leak on third party website lead to preview all action from store owner Without store Password.
Shopify Improper Authentication - Generic (CWE-287)
Medium
2021-07-12
Exposed Prometheus instance at prometheus.qa.r3.com
R3 Information Disclosure (CWE-200)
Medium
2021-07-12
高频漏洞类型
最活跃项目
项目报告数最高赏金
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud583—
Shopify464—
curl442—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239—